[CLAUDE] Phase5 prep: production infra + deploy scripts + 4 guides + FE refresh token

Backend production infra:
- Packages: Serilog.Sinks.File, HealthChecks.EntityFrameworkCore (RateLimiting built-in .NET 10)
- appsettings.Production.json MOI: placeholder __SET_VIA_SECRETS__, AllowedOrigins, Serilog File sink rolling daily retention 30d, RateLimit config
- appsettings.json + Development.json: them Serilog WriteTo Console
- Program.cs REWRITE:
  - Serilog ReadFrom.Configuration (prod file / dev console)
  - Rate limiter: policy auth-login 5/min/IP (AuthController.Login) + GlobalLimiter 300/min/IP
  - Health checks: /health/live liveness (empty predicate) + /health/ready DB probe (AddDbContextCheck)
  - HSTS production 1 year
  - CORS origins from config AllowedOrigins (default dev 2 localhost)
- AuthController.Login gắn [EnableRateLimiting("auth-login")]

Deploy scripts:
- scripts/deploy-iis.ps1: stop pool → backup current → clean+extract artifact → start pool → health check loop 30s timeout → rollback instruction if fail
- scripts/backup-sql.ps1: BACKUP DATABASE voi INIT+COMPRESSION+CHECKSUM + retention 30d auto cleanup
- .gitea/workflows/deploy.yml MOI: 4 job build BE (Windows) + build 2 FE (Ubuntu, pin .nvmrc 20) + deploy-iis qua WinRM PSSession (secrets IIS_HOST/USER/PASSWORD/JWT_SECRET/DB_CONNECTION)

Docs guides MOI (4 file):
- deployment-iis.md: prereqs (IIS features, Hosting Bundle, SQL, WinRM) + setup lan dau (app pool, 3 site, HTTPS win-acme, user-secrets) + deploy hang ngay (CI/CD + manual) + rollback + monitoring + troubleshooting + SPA web.config sample
- cicd.md: pipeline overview 4 job, secrets setup, runner Windows+Ubuntu, branch strategy, build optimizations, common CI/CD issues
- security-checklist.md: OWASP top 10 2021 mapping voi status + pre go-live checklist + incident response
- runbook.md: daily ops (health/logs), restart/rollback, DB backup/restore/migration revert, user management (reset password, unlock, disable), monitoring (CPU/disk/connection pool), deployment checklist, common gotcha

Frontend refresh token (ca 2 app fe-admin + fe-user):
- lib/api.ts REWRITE: them REFRESH_KEY, axios response interceptor 401 → POST /auth/refresh → retry request goc. Queue pattern cho nhieu request song song chi 1 refresh call chay. Skip retry /auth/login + /auth/refresh tranh infinite loop. _retry flag tren original config.
- contexts/AuthContext.tsx: luu+xoa REFRESH_KEY trong login/logout

E2E verified:
- GET /health/live → 200 Healthy
- GET /health/ready → 200 Healthy (DB probe)
- Rate limit flood 7 POST /auth/login → #1-5 HTTP 400 (cred sai) + #6-7 HTTP 429 Too Many Requests ✅
- TS check fe-admin + fe-user → pass
- dotnet build → 0 errors

Docs updates:
- docs/STATUS.md: Phase 5 prep done, next Phase 5 deploy production + Phase 5.1 security hardening, cumulative stats 8 commits
- docs/HANDOFF.md: phase table them Phase 5 prep row, file tree update voi guides + scripts + workflows, git state commit 8
- docs/changelog/migration-todos.md: tick Phase 5 prep items (12 items done) + Phase 5 deploy items remaining + Phase 5.1 security hardening list
- docs/changelog/sessions/2026-04-21-1530-phase5-prep.md: session log chi tiet

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

docs/HANDOFF.md

@@ -1,6 +1,6 @@
 # HANDOFF — Brief 5 phút cho session tiếp theo
 
-**Last updated:** 2026-04-21 14:30 (cuối Phase 4 MVP + docs consolidation)
+**Last updated:** 2026-04-21 15:30 (cuối Phase 5 Prep)
 
 ## Ở đâu rồi?
 
@@ -12,10 +12,12 @@
 | 2 Form Engine MVP | ✅ Done |
 | 2 Form Engine iteration 2 | 📝 Optional |
 | 3 Workflow MVP (9 phase + code gen) | ✅ Done |
-| 3 Workflow iteration 2 (SLA job + notify + attachment) | 📝 Optional |
-| **4 Report + Polish MVP (Dashboard + Excel)** | ✅ Done |
-| 4 Report iteration 2 (SLA report, PDF export) | 📝 Optional |
-| 5 Production (CI/CD IIS) | 📋 Next |
+| 3 Workflow iteration 2 (SLA + notify + attachment) | 📝 Optional |
+| 4 Report MVP (Dashboard + Excel) | ✅ Done |
+| 4 Report iteration 2 | 📝 Optional |
+| **5 Prep (infra + scripts + guides + refresh token)** | ✅ Done |
+| 5 Deploy production (cần Gitea URL) | 📋 Next |
+| 5.1 Security hardening (headers, lockout, IDOR) | 📋 Queue |
 
 ## Run nhanh
 
@@ -139,21 +141,28 @@ SOLUTION_ERP/
 │       ├── LoginPage
 │       ├── InboxPage  ← Phase 3
 │       └── contracts/ContractCreatePage, ContractDetailPage, MyContractsPage  ← Phase 3
-├── docs/                      (30 file)
+├── docs/                      (35 file)
 │   ├── STATUS.md, HANDOFF.md, rules.md, architecture.md
 │   ├── CLAUDE.md, PROJECT-MAP.md
 │   ├── workflow-contract.md, forms-spec.md
 │   ├── database/{database-guide, schema-diagram}.md
 │   ├── flows/ (7 file — README + 6 flow)
-│   ├── changelog/migration-todos.md + sessions/ (6 session log)
+│   ├── guides/ (4 file) — deployment-iis, cicd, security-checklist, runbook  ← Phase 5 prep
+│   ├── changelog/migration-todos.md + sessions/ (7 session log)
 │   └── gotchas.md
+├── scripts/                    (5 file PS + py)
+│   ├── parse_forms.py, parse_workflow.py (Phase 0)
+│   ├── convert-doc-to-docx.ps1 (Phase 2)
+│   └── deploy-iis.ps1, backup-sql.ps1  ← Phase 5 prep
+├── .gitea/workflows/deploy.yml ← Phase 5 prep CI/CD template
 └── .claude/skills/            (3 skill — all full spec)
 ```
 
 ## Git state
 
 ```
-(sẽ là commit 7) — Phase 4 Report MVP + docs consolidation
+(sẽ là commit 8) — Phase 5 Prep (infra + scripts + guides + refresh token)
+fe7ad8e — Phase 4 Report MVP + docs consolidation
 7e957a7 — Phase 3 Workflow MVP
 5113e4c — Phase 2 Form Engine MVP
 54d6c9b — Phase 1.2 CRUD + Permission
@@ -162,7 +171,7 @@ SOLUTION_ERP/
 25dad7f — Phase 0 scaffold
 
 Branch: main
-Remote: chưa (Gitea URL chờ user — cần cho Phase 5)
+Remote: chưa (Gitea URL CẦN NGAY để Phase 5 go-live)
 ```
 
 ## Credentials + URLs